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I. OVERVIEW FOR THE FEDERAL BUREAU OF INVESTIGATION 
A. Introduction 

The Anonymous 'collective' has risen from an amorphous group of individuals on the internet to 
the current state of a potential threat to national security. Due to the nature of anonymous, they 
believe that they are a leaderless collective. However, it has been shown that there is a defined 
leadership group. The goal of this report is to better understand that leaderships structure and its 
members psychological states in order to better assess who they really may be as well as define 
means to effectively track them down for arrest. 

By using the techniques and resources of the BSU at Quantico, we hope to enlighten the 
investigators to cues that could help in manipulating and apprehending the leadership of 
Anonymous. This will have a profound effect on the collective itself as the arrest of the core 
would demoralize the whole. 

II. PSYCHOLOGICAL PROFILING APPROACH 

Due to the nature of Anonymous and the internet, the leaders of the collective have attempted to 
cloak their identities within screen names and technological obfuscation methods. Since the 
internet has many ways to hide a person's true identity, the Behavioral Sciences Unit was 
contacted to assess the individual's online personae through online dialogs. 

Working this case was approached in the same manner as any other UNSUB (Unknown Subject) 
that the BSU handles, however, the context from this particular case has been augmented by 
technical services branch members. The upshot of this is that the network technical and forensics 
teams provided not only the content from which we at the BSU would audit, but also context as 
to how the UNSUB's attempted to hide their identities. The marrying of all of the technical as 
well as the contextual data has resulted in this report. 

A thorough assessment of each UNSUB's online activities, speech patterns, and general writings 
was collected by the FBI. Each UNSUB was individually assessed by members of the SBU and a 
psychological profile created from these datasets. Some of this data was also collected from 
sources such as CPs in the field. One such CI (Marotte) has been quite effective in engaging the 
Anonymous leadership and thus gathering intelligence that was helpful to the SBU in gauging 
their psychological makeup under differing circumstances. 

The following report is to be used as a guide not only to perhaps locate the individuals by region, 
sex and age, but also to give insight to the agents in the field carrying out operations to capture 
these actors. By knowing the traits of these leaders, one can extrapolate the larger motivations 
and perhaps even anticipate actions on the part of Anonymous and its splinter cells. 
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HI. ANONYMOUS COLLECTIVE BACKGROUND 

From Wikipedia: 

Anonymous (used as a mass noun) is a group initiating active civil disobedience and spread 
through the Internet while staying hidden, originating in 2003 on the imageboard 4chan, 
representing the concept of many online community users simultaneously existing as an 
anarchic, digitized global brain. [2] It is also generally considered to be a blanket term for 
members of certain Internet subcultures, a way to refer to the actions of people in an 
environment where their actual identities are not known. [3] 

In its early form, the concept has been adopted by a decentralized online community acting 
anonymously in a coordinated manner, usually toward a loosely self-agreed goal, and primarily 
focused on entertainment. Beginning with 2008, the Anonymous collective has become 
increasingly associated with collaborative, international hacktivism, undertaking protests and 
other actions, often with the goal of promoting internet freedom and freedom of speech. Actions 
credited to "Anonymous" are undertaken by unidentified individuals who apply the Anonymous 
label to themselves as attribution. [4] 

Although not necessarily tied to a single online entity, many websites are strongly associated 
with Anonymous. This includes notable imageboards such as 4chan, Futaba, their associated 
wikis, Encyclopaedia Dramatica, and a number of forums. [5] After a series of controversial, 
widely-publicized protests and distributed denial of service (DDoS) attacks by Anonymous in 
2008, incidents linked to its cadre members have increased. [6] In consideration of its 
capabilities, Anonymous has been posited by CNN to be one of the three major successors to 
WikiLeaks.[7] 



BSU Quantico 



LES (Law Enforcement Sensitive) 



USDOJ 



3 



IV. PROFILES 

1 UNSUB Sabu 

Approximate age: 29-35 
Sex: Male 
Location: USA 

Probable Nationality: American 

Language Indicators: Slang and diction (American) 

Profile: Sabu is the overall leader of the LulzSec group and since the arrest of 
Topiary, has taken over the spokesperson role for Anonymous. Sabu's character is the 
strongest of the named group and is definitely in charge. Sabu is technically 
competent within the realm of computer technologies and is the elder of the group of 
Anonymous UNSUB 's 

Sabu has character traits of a professional adult individual who puts on the guise of a 
"script kiddie" in language (netspeak) but functions within his normal day to day life 
within the business community without casting any clues to his other online activities. 
It is likely that Sabu works in the information security sector and has been doing so 
since the early days of the internet and hacking activities. His use of net speak is 
interspersed with proper American English diction and grammar that implies he is an 
American citizen and has been educated. 

Varying logs from online IRC (Internet Relay Chat) sessions have borne out the 
possibility however, that the user ID "Sabu" is sometimes also used by others to 
confuse authorities and others as to who the real person is behind the keyboard. 
However, through an amalgam of transcripts the tell tale signs of a consistent 
individual can be clearly seen and assessed. 

Overall, a picture emerges from these sessions that can lend to a psychological 
assessment of the individual who calls himself "Sabu" The following bulletized 
points are the key findings. 

Psychological Makeup and Personal Details: 

• Likely married and employed in the technology sector 

• Has amoral tendencies and see's the world from a nihilistic perspective 

• Spelling correction on chat logs shows compulsive behaviors 

• Shows narcissistic tendencies 

• Likely to be living in North America (East Coast) Perhaps NYC 

• Prideful and likely easily prone to reaction through manipulation 

• Very conformist in everyday life 

• Lives out rich fantasy life online (feeling important and empowered) 

• Perceives himself as a martyr for the cause (his own cause) 
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Assessment: Sabu is skilled and capable according to the technical group, however, 
the tendencies toward attention seeking pathologies and his ego driven desires will be 
the most likely way to attempt to apprehend him. It is recommended that the 
investigation use CPs and operatives online to continue to engage him online in chats. 
Manipulation of language and emotions through these chats will indeed lead to 
further information to be disclosed by him or others. 

It is recommended that the BSU insert a team member into the LulzSec/ Anonymous 
investigation to interface online with the subject(s) and further the social and 
psychological investigation of the group and its leadership in an attempt to flesh out 
further information. 



2 UNSUB Kayla 

Approximate age 22-27 
Sex: Male 

Probable Location: USA (Middle America) 
Probable Nationality: American 

Profile: Kayla is the online persona for this individual who ran the botnet's 
(compromised zombie computers) to run attacks against sites and users with DDOS 
(Distributed Denial of Service) attacks. Kayla claims to be a girl but the intelligence 
gathered places the sex of the UNSUB as male. 



Psychological Makeup and Personal Details: 

Kayla is one of the more introverted members of the group and is a close lieutenant to 
Sabu. Kayla is submissive and has a tendency to be aggressive toward anyone who he 
feels has slighted him in any way. Chat logs show a penchant for entendre and use of 
netspeak that denotes a younger person as well as perhaps a stunted emotional age 
that does not connect with his real age. 

• Possibly bisexual 

• Likely abused as a child 

• Likely inferiority complex due to childhood trauma 

• Potentially violent behavior possible offline in real world activities 

• Amoral personality traits 

• Attention seeking personality seeking father figure approval 

• Possible persistent drug use 

• Likely from a broken home 

Assessment: Kayla aka Lolspoon (twitter) is a likely target for an attempt to correlate 
his online persona with others in the alternative lifestyle internet underground. SA's 
attempting to interface with Kayla should keep in mind that he is easily pushed to 
anger and this can be used. It is recommended that the investigators push this 
individual as frequently as possible to make him react and thus potentially slip up in 
anger. 
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3 UNSUB Topiary (Status captured) 

Age: 18 
Sex: Male 

Location: Shetland Islands UK, Scotland 

Profile: Topiary aka Jake Davis has been apprehended and as such this profile is only 
for backstopping purposes. An ongoing evaluation of his personality and his life is 
being carried out by the Met and Scotland Yard presently. Topiary was the de facto 
spokesman for Anonymous and LulzSec and is very outspoken. 

Toipiary /Davis, is a young individual with a defined ethos of counter culture 
behaviors. At the time of his arraignment Davis carried a book on revolutionary 
scientists and made sure that the press could see this as a means to show his point of 
view and defiance of the common laws. 

Psychological Makeup and Personal Details: 

Out of the group Topiary is the altruist who believes in what he is doing on the 
outside of it. Internally, his sense if right and wrong are skewed toward self fulfilling 
outcomes. Davis it is believed has been used and co opted by the others within the 
anonymous leadership as cannon fodder. 

• A true believer in his world view that society has failed 

• Youthfully idealistic 

• Ego driven in his convictions 

• Obsessive personality traits including possible Aspergers syndrome 

• Socially inept and withdrawn 



5 UNSUB JoePie91 

Approximate age 21-26 
Sex: Male 
Location: EU 

Profile: JoePie is a technical individual who is third in command. His skill are in the 
coding area and also has partaken in the actual hacking carried out by LulzSec and 
Anonymous. Joepie's political views on performing hacking against targets only 
extends to the point of actually breaking the law. JoePie has alleged that his is a 
support role only, and as such, not breaking the law. 

Psychological Makeup and Personal Details: 

JoePie is intelligent and well spoken. He tends to not use as much netspeak as the 
others and makes relevant arguments in correct grammatical syntax. There are times 
when the syntax and grammar infer that JoePie is not an American and may in fact be 
in the EU. 

It is recommended that the approach to be taken with JoePie is to align the agent's 
commentary to JoePie' s. Use common ideals stemming from commentary in the HB 
Gary and other IRC chats captured to gauge the approach. 
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• Likely a college student but may be just out of college 

• Technically capable and versed (mention of coding and technical measures) 

• More autonomous member of the group 

• Amoral character traits and personal beliefs 



6 UNSUBTflow 

Approximate age 22-26 
Sex: Male 
Location: USA 

Profile: Tflow shows a more mercenary approach to the LulzSec and Anonymous 
campaigns. His motivations seem to be monetarily based and may in fact be a paid 
asset for the group as a freelance hacker. Tflow is a key player in the command and 
control of their domain registration and management. In essence, Tflow is a key 
target for taking down the infrastructural underpinnings of the group. 

• Pseudo-intellectual that lacks true educational background 

• Monetarily driven 

• Likely has a criminal history 

• Has cognitive dissonance over hacktivism and activism 
Psychological Makeup and Personal Details: 

The psychological makeup as glimpsed from the IRC chats leads the investigators to 
believe that Tflow may be the linchpin to attack as he runs the technology side of 
their internet space. As such he is intimately familiar with all of the players and may 
in fact know personal details that would be helpful in prosecution of the other key 
members. 

It is also recommended that Tflow may be easily turned against the group due to his 
cognitive dissonance over hacktivism as well as he desires for monetary gain. This 
also flows into his likely attitudes that he is not willing to go down for the group 
should his identity be compromised. BSU recommends that Tflow be a key target for 
agents in the field to approach. 

V. CONCLUSION 

In conclusion, the BSU recommends more investigation be carried out online to investigate these 
users by inserting agents into their chat rooms as well as gather more CI's who can do the same. 
Because of the nature of Anonymous and the internet, it is harder to get a real idea of where 
users are if they know how to hide their tracks online. The use of the social aspects (what 
hackers would call 'social engineering') will be key to gaining access to data that will eventually 
lead to capture. 

These profiles are solely based on internet chats and as such, may also be somewhat incorrect as 
the users know that they are being monitored in certain areas of the internet. However, as an 
aggregate, the data presented and assessed gives the BSU some confidence in the data presented 
here. It is the recommendation of the BSU that this report be re-assessed as more data comes 
from assets in the field and through interviews carried out with Topiary (Davis) by the Met and 
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the FBI field agents tasked to the UK for interviews. Overall, the assessment here is that we have 
a group of younger individuals being lead by an older, more experienced one in an effort that 
seems to have conflicted ideals. Additionally, because there are many personalities involved and 
Anonymous claims to be a larger 'collective' group without leaders, it is easier to assume that 
there are other cells and other leaders. These leaders and groups may not be chatting in the open 
areas of the IRC, but in fact have learned from the experiences of this group to be more discreet 
about their activities and planning. 

The overall assessment for the movement however is the following: 

1 . The movement is out of control and there seems to be no real coherent motivation 

2. The leaders have begun to hide themselves a bit more due to arrests that have been made 

3. Their reliance on technology will eventually be their downfall 

4. Their interpersonal relationships are weak points, as such they should be leveraged 

5. Their increasing attacks on infrastructure will eventually lead to serious results that could 
in fact lead to deaths 

It is after the first real attributable deaths that there may be a tapering off of their ranks as the 
members realize that by outing individuals, actual physical actions can occur that cause great 
damage. Until such time though, the movement will continue with the masses used as fodder and 
the command structure urging them on to carry out their commands. 
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ANNEX: A Twitter Logs 
REDACTED See Enclosure A 



ANNEX: B Chat Logs 
REDACTED See Enclosure B 
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